Sensitivity Analysis of the Realized Risks of Auditing with Uncertainty Concerning Internal Control Evaluations

Abstract

Recent developments in the auditing literature indicate increasing concern about the relationships among different audit procedures in controlling ultimate risk in auditing. Ultimate risk can be defined as the risk of material errors remaining undetected after the audit is completed. For example, the AICPA's SAS No. 39 [1981], the CICA's Extent of Audit Testing Study [1980], Kinney [1983], and a 1983 University of Georgia symposium on the extent of audit testing all reflect concern for the risk implications of combining various sources of audit evidence. Specifically, the concern is that realized ultimate risks can be greater than planned when combining various audit procedures and sources of evidence. Since the reliability of the audit process itself may be in question, this is an important issue of auditing theory and practice. In this paper I focus on the ultimate risk implications of combining internal control evaluations with substantive testing of details. In conformity with the professional literature (e.g., SAS No. 39), I focus on risk control and do not consider a more complete decision-theoretic approach that incorporates a total expected cost function. Consistent with much of the literature, I focus on the risks at the account or balance level and not on financial statements as a whole. Thus my objective is